IN THE CLAIMS 

Please Amend the Claims as Follows: 

1. (currently amended) A method of classifying a message transmitted over a network, 
comprising: 

executing instructions stored in a computer readable storage medium to 
determine determining the domain from which the message is purported to be sent; 

executing instructions stored in a computer readable storage medium to 
determine determining an IP address from the message, the IP address corresponding to 
a device -which the message was relayed at some point in transmission of the message; 

executing instructions stored in a computer readable storage medium to 
associate associating the domain with the IP address to create an IP address and domain 
pair; 

executing instructions stored in a computer readable storage medium to classify 
classifying the message using according to the IP address and domain pair based on one 
or more classification variables associated with the IP address and domain pair; and 

executing instructions stored in a computer readable storage medium to assign 
assigning a score to the IP address and domain pair, the score comprising a ratio of a 
first classification variable to a second classification variable, the one or more 
classification variables decaying with time. 

2. (currently amended) The method of claim 1, further comprising executing 
instructions in a computer readable storage medium to override overriding a white list 
based on the classification. 

3. (previously presented) The method of claim 1, wherein classifying includes 
comparing the IP address and domain pair with a related IP address and domain pair. 
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4. (previously presented) The method of claim 1, wherein classifying includes checking 
classifications of other messages associated with the domain and different IP addresses. 

5. (original) The method of claim 1, wherein a plurality of IP addresses is associated 
with the domain. 

6. (original) The method of claim 1, wherein the IP address is associated with a plurality 
of domains. 

7. (original) The method of claim 1, wherein the IP address is a boundary IP address. 

8. (original) The method of claim \, wherein the IP address is preconfigured. 

9. (original) The method of claim 1, wherein the IP address is preconfigured to be one 
hop from a gateway IP address. 

10. (original) The method of claim 1, wherein the IP address is learned. 

11. (original) The method of claim 1, wherein the IP address is adaptively determined. 

12. (cancelled). 

13. (previously presented) The method of claim 1, wherein the IP address is a boundary 
IP address. 

14. (previously presented) The method of claim 1, wherein determining the domain 
from which the message is purported to be sent includes identifying the stated sender 
domain associated with the message. 
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15. (previously presented) The method of claim 1, wherein the domain is a domain 
associated with a boundary IP address. 

16. (original) The method of claim 1, wherein classifying includes consulting a white 
list. 

17. (original) The method of claim 1, wherein classifying includes classifying the 
message based on previous classifications made to the IP address and domain pair. 

18. (cancelled) 

19. (currently amended) The method of claim 1, wherein classifying assigning the score 
includes determining a spam ratio. 

20. (currently amended) The method of claim 1, wherein classifying assigning the score 
includes determining a spam rate. 

21. (currently amended) The method of claim 1, wherein classifying assigning the score 
includes determining an estimated instantaneous spam rate. 

22. (cancelled) 

23. (currently amended) The method of claim 1, wherein classifying includes giving a 
classification variable greater weight relative to another classification variable . 

24. (currently amended) The method of claim 1, wherein classifying includes giving a 
classification variable associated with user classification greater weight relative to a 
classification variable associated with computer classification. 
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25. (original) The method of claim 1, wherein classifying includes giving an 
indeterminate classification a fraction of the weight of a good classification. 

26. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain. 

27. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain wherein each cell includes information about 
previous classifications. 

28. (previously presented) The method of claim 1, further comprising providing a 
classification based on the IP address and domain pair as input to another classifier. 

29. (previously presented) The method of claim 1, further including providing a 
classification based on the IP address and domain pair as input to a Bayesian classifier. 

30. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the IP address. 

31. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain. 

32. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain and determining that the message was forged. 

33. (original) The method of claim 1, wherein classifying includes determining a score 
for the IP address. 
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34. (original) The method of claim 1, wherein classifying includes determining a score 
for the domain. 

35. (currently amended) A computer-readable storage medium having embodied 
thereon a program, the program being executable by a processor to perform a method 
for classifying a message, the method comprising: 

determining a domain from which the message is purported to be sent; 
determining an IP address from which the message was relayed at some point in 
transmission of the message; 

associating the domain with the IP address to create an IP address and domain 

pair; 

classifying the message using according to the IP address and domain pair based 
on one or more classification variables associated with the IP address and domain pair; 
and 

assigning a score to the IP address and domain pair, the score comprising a ratio 
of a first classification variable to a second classification variable, the one or more 
classification variables decayed with time. 

36. (cancelled) 
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